UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest
Jaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours
A 26-year-old UK developer, known as "Killa," has claimed a $2,000 Bitcoin prize for exploiting the PHP2Shell vulnerabilities that caused internet disruption. James Pavur launched the "Steal My Bitcoin" site on October 24 to prove the PHP2Shell exploit was not as simple as claimed, offering $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website.
Modhwadia achieved RCE on the website in approximately three hours, exposing a PHP endpoint, despite the website's owner claiming it took 19.28 hours due to the site becoming unusable. After an error with a wallet key, Pavur awarded Modhwadia the Bitcoin prize, which was later increased to $2,000. Modhwadia published a write-up of his method, a Python script requiring 20 HTTP requests at most.
Bug bounty hunters attempted the challenge, but the site became unusable due to its popularity. Alon Gal, co-founder and CTO at Hudson Rock, praised Modhwadia's work but emphasized it was a sophisticated, target-specific exploit, not indicative of an automated attack.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
